Title:
======
nCircle PureCloud Vulnerability Scanner - Multiple Web Vulnerabilities
Date:
=====
2013-01-28
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=795
nCircle Tracking ID: 20130117-US11337
VL-ID:
=====
795
Common Vulnerability Scoring System:
====================================
4.1
Introduction:
=============
nCircle PureCloud is brought to you by nCircle, the leading provider of information risk and security performance management solutions.
PureCloud delivers an enterprise-class vulnerability scanner with more than double the coverage of other providers covering thousands of
conditions and prioritized risk assessments – all in a cloud-based solution.
nCircle PureCloud is the world’s first security scanning technology that requires no scanning infrastructure on the customer network.
PureCloud eliminates the need for firewall changes and software or hardware deployment on a customer`s internal network.. Requiring only
a Web browser, PureCloud securely scans a private network to identify a broad range of vulnerabilities and risks, and provides detailed
guidance on the steps necessary to reduce or eliminate those risks. With PureCloud, small businesses and home offices benefit from nCircle’s
most advanced enterprise class security scanning solution, without the complexity or maintenance associated with traditional SaaS or on-premise
scanning products. PureCloud is delivered as a software service in the Cloud, making it cost-effective, efficient and widely accessible.
(Copy of the Vendor Homepage: https://purecloud.ncircle.com/about_purecloud/ )
Abstract:
=========
The Vulnerability-Laboratory Research Team discovered a web vulnerability in the nCircle PureCloud (cloud-based) Vulnerability Scanner Application.
Report-Timeline:
================
2012-12-24: Researcher Notification & Coordination
2012-12-25: Vendor Notification
2012-01-16: Vendor Response/Feedback
2012-01-28: Vendor Fix/Patch by nCricle Dev
2012-01-28: Public Disclosure
Status:
========
Published
Affected Products:
==================
nCircle
Product: PureCloud - Vulnerability Scanner (cloud-based) 2012 Q4
Exploitation-Technique:
=======================
Remote
Severity:
=========
Medium
Details:
========
A persistent and client side POST Injection web vulnerability is detected in the in the nCircle PureCloud (cloud-based) Vulnerability Scanner Application.
The vulnerability typus allows an attacker to inject own malicious script code in the vulnerable module on application side (persistent).
1.1
The first vulnerability is located in the Scan Now > Scan Type > Perimeter Scan > Scan section when processing to request via the
`Scan Specific Devices - [Add Devices]` module and the bound vulnerable formErrorContent exception-handling application parameters.
The persistent injected script code will be executed out of the `invalid networks` web application exception-handling. To bypass
the standard validation of the application filter the attacker need to provoke the specific invalid networks exception-handling error.
In the secound step the attacker splits the request of the invalid filter context to execute after it the not parsed malicious script code.
The vulnerability can be exploited on client side via force manipulated link as malicious request with medium user interaction but also
via server side by a post injection in the later affected add server listing module.
1.2
The secound vulnerability is bound to the first issue and located in the IP & Name output listing of the scan index after processing to
add a network/server/ip. The code will be executed out of the main ip & name listing after an evil inject via add module. To bypass the
ip restriction filter it is required to split the request like in the first issue with a valid ip. The remote attacker includes a
valid ip+split(%20)`+own_scriptcode to pass through the system validation filter and execute the script code out of the device name and ip listing.
The vulnerability can be exploited with privileged application user account and low or medium required user interaction.
Successful exploitation of the vulnerability result in persistent/non-persistent session hijacking, persistent/non-persistent
phishing, external redirect, external malware loads and persistent/non-persistent vulnerable module context manipulation.
Vulnerable Service(s):
[+] nCircle PureCloud (cloud-based) Vulnerability Scanner [https://purecloud.ncircle.com/index/]
Vulnerable Section(s):
[+] Scan Now > Scan Type > Perimeter Scan > Scan
Vulnerable Module(s):
[+] Scan Specific Devices - [Add Devices]
[+] Scan IP (Index)
Vulnerable Parameter(s):
[+] formErrorContent
[+] ip &- name
Affected Module(s):
[+] Exception Handling - Invalid Network(s)
[+] Scan Index - Listing
Proof of Concept:
=================
The client- & server-side web vulnerability can be exploited by remote attackers and local privileged application user accounts with
low or medium user interaction. For demonstration or reproduce ...
1.1
Note:
When you try to inject a standard iframe, img src, script or onload the context will be parsed by the exception-handling to
prevent the first execution after the inject attempt. To bypass the validation we first inject a frame which matches with the invalid
exception filter to display the error. Now, we split the request with %20 and inject our code after the split via POST.
Manually Exploitation:
1. Register an account at nCircle PureCloud to get access to the (cloud-based) Vulnerability Scanner- [https://purecloud.ncircle.com/registerinfo3/?hacknewssocial]
2. Login to your account and switch to the scan now menu, open the scan type site
3. Choose the Perimeter Scan, not the local one!
4. Include a standard script alert tag to provoke the exception-handling, split the request with %20' and inject your own frame onload script code. Save via Add!
5. The scirpt code will be executed out of the exception-handling invalid networks message.
6. Done #1 ... Successful reproduced! Press Continue to exploit also the listing :)
7. Include a valid ip, split the request (bypass the input restriction) and inject after it your own script code.
8. Watch the scan index. The code will be executed out of the vulnerable name and ip value output listing.
9. Done #2 ... Successful reproduced!
PoC:
#1